[SOLVED] Asus Armoury Crate False Positive?

[dbs_]

Hi all,

Just bought a new Asus ROG Flow X13. Comes pre-bundled with all the usual bloatware, however one piece of software I did want to keep was the Armoury Crate as it gives some extra functionality with the 2-in-1 flip functionality of the device.

I've run into a problem though with Windows flagging a script as a Trojan, similar to as what is described in this forum post:

Trojanised / Hacked Asus LiveUpdate (Armory crate?)

Hey forum user, Are you using Asus LiveUpdate (Armory Crate?), then i suggest you stop using it and go back (like i do) the old fashioned way. Update things yourself by visiting the board website. Here's why you don't WANT it working / shouldn't be using it! Just got this linked by one of my...

rog.asus.com

Problem is, this was pre-installed on my device. I've since removed it to be on the safe side, and have even tried downloading the latest version from Asus's website, however Windows continues to contain the script causing the program to seemingly not function correctly.

I've run Malwarebytes to get a second opinion on it and it doesn't flag the script.

Has anyone else here experienced this and if so, can you confirm whether this is a known issue with Windows just not liking the script or an actual Trojan virus?

Cheers all.

 

[Colif]

so defender thinks armory crate is a virus?

link is from 2 years ago, most of the links I found about it are 2 years ago. Can't really find anything recent

what is the name of the script? give us something to work with.

 

[dbs_]

so defender thinks armory crate is a virus?

link is from 2 years ago, most of the links I found about it are 2 years ago. Can't really find anything recent

what is the name of the script? give us something to work with.

Yes, Defender thinks it's a dangerous trojan. Just looked back through defender history, sorry should've sent this through before- "Trojan:Script/Sabsik.FL.A!ml".

It was found in a zip in my AppData\Local\Temp\ folder.

Thanks.

 

[Colif]

https://www.microsoft.com/en-us/wds...jan:Script/Sabsik.FL.A!ml&ThreatID=2147780199

try running this and see if it has the same reaction as defender - https://www.bitdefender.com.au/solutions/free.html

 

[dbs_]

Cheers for that, just re-installed the Asus app and ran Bitdefender, didn't trigger any warnings on the script. Do you reckon it's a false positive on Defender?

 

[Colif]

it might be, i didn't look too hard into file.

file found in a steam download, suspected false positive by defender - https://steamcommunity.com/discussions/forum/0/3165461775594224582/
ml suspected to mean machine learning so it might just see armory crates actions as a virus. Its odd though as i would have expected to see it more with that program it auto installs itself on new Asus boards after the first boot.

https://en.delphipraxis.net/topic/5470-trojanscriptsabsikteaml-detected-false-positive-of-course/ defender again.

I think its only defender who sees this file as a problem

Bitdefender is pretty accurate when it comes to finding problems. I use it myself.